Privacy policy

Who we are

exprand.com is operated by Centurion Creatives, REVIEW — add the registered address before launch. We are the data controller for the personal data described here. For anything in this policy, write to privacy@exprand.com.

What we collect

If you play without an account

We store an anonymous identifier in a cookie so we can tell that the six guesses in one game belong to the same person, and so refreshing the page does not restart your puzzle. It is a random value and is not linked to your name or email.

Alongside it we record your guesses, how long each one took, whether you solved the puzzle, your score, and any difficulty rating you give.

If you sign in

Signing in with Google gives us your email address, your name and your profile picture. Your name and picture are never shown publicly — the leaderboard displays only the gamertag you choose, which we generate for you at sign-up and which you can change at any time.

We also keep your play history, streaks and lifetime statistics so the dashboard and leaderboard work.

Technical information

Our host records standard request logs. We store an approximate country and a broad device type (phone, tablet, desktop) against each game, so that timing statistics can be compared fairly — people type faster on a keyboard than a phone.

To stop automated abuse we keep a one-way cryptographic hash of your IP address for up to one hour. We do not store the address itself, and the hash is deleted automatically.

We also measure how the site is used — page views, and how quickly pages load — through Vercel Web Analytics, who host the site. It sets no cookies and stores nothing on your device. It records the page visited, the referring site, and a coarse country and device type; it does not build a profile of you or follow you to other websites, and we cannot use it to identify you.

Why we are allowed to use it

• To provide the game and your account— necessary to perform our contract with you.
• To prevent cheating and abuse, and to produce aggregate statistics about brand recognition — our legitimate interests. We have weighed these against your rights and use the least identifying data that works.
• For advertising and marketing email— your consent, which you can withdraw at any time. Neither is active on the site today.

Aggregate statistics

Exprand measures how much of a logo people need before they recognise a brand. We combine everyone’s results into aggregate figures — solve rates, typical recognition speed, the most common wrong guesses — and we intend to license those figures to brand owners and researchers.

Those aggregates never identify you. They contain no names, no email addresses and no account identifiers, and we only produce them from large enough groups that no individual result can be picked out. We do not sell personal data.

Who else sees it

We use a small number of service providers to run the site. They process data only on our instructions and are listed, with what each one handles, on our subprocessors page.

Those providers are based in the United States, so your data is transferred outside the UK and EEA. Those transfers are covered by Standard Contractual Clauses.

How long we keep it

• The anonymous play cookie lasts one year.
• Abuse-prevention IP hashes are deleted after one hour.
• Account and gameplay records are kept while your account exists.
• If you delete your account we remove your personal data and your individual play records. Figures already combined into aggregate statistics cannot be pulled back out and will remain, but they do not identify you.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent you can withdraw it at any time.

Email privacy@exprand.com and we will respond within one month. You can also complain to your local data protection authority; in the UK that is the Information Commissioner’s Office.

Children

Exprand is not intended for children. You must be at least 16 in the UK and EEA, or 13 elsewhere, to create an account. If you believe a child has given us personal data, contact us and we will delete it.

Cookies

We explain every cookie we set, and why, on our cookie policy.

Changes

If we change this policy we will update the date at the top, and tell registered players by email if the change is significant.